OK, best payload initiation vectors. Eg. DOC Macro, Excel Macro, HTA, VBS, JS, SLK, What else...?
When I was playing around with EICAR in a VHD, I tested with as small as 1MB in size. Maybe with trickery they could be made even smaller. But I suspect that in many cases the VHD can be not too much larger than the payload itself.
-
-
Ah, I see - just as a raw container, not as a self-contained OS instance. Interesting. So an additional component would tap the payload from within the image, and/or user prompts to do so. Iiiiinteresting.
-
Starting with Windows 8, a VHD or VHDX file can be double-clicked and opened in Explorer as if it were a ZIP container. At this point, you're relying on the user to not do something unwise. Without any of the MoTW-based protections.
- 2 more replies
New conversation -
-
-
(Hey, one engine actually detects it now!)
- 2 more replies
New conversation
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.